The exhibits show the configuration of static routes and a session table entry for an active session. The static routes are configured with different priorities:
* Route throughport1with a gateway of10.200.1.254and priority5.
* Route throughport2with a gateway of10.200.2.254and priority10.
If the priority of the route throughport2is changed from10to0, this route will become more preferred than the route throughport1because lower priority values indicate higher preference. As a result, the traffic for the existing session will switch to using the more preferred route:
* The session would remain active in the session table, as FortiGate does not immediately clear sessions upon route changes unless explicitly configured to do so.
* The traffic for the session would then start egressing fromport2, which now has the higher priority route due to its lower priority value.
References
* Fortinet Documentation on Routing Configuration
* Fortinet Community on Session Handling

* SNI and Certificate Mismatch:When the Server Name Indication (SNI) does not match either the Common Name (CN) or any of the Subject Alternative Names (SAN) in the server certificate, FortiGate's default behavior is to consider this as an invalid SSL/TLS configuration.
* Default Action:FortiGate, under default settings for SSL certificate inspection, will close the connection to prevent potential security risks associated with mismatched certificates.
References:
* Fortinet Community: SSL Certificate Inspection Configuration and Behavior(Welcome to the Fortinet Community!).

* Anti-replay Enabled:
* The exhibit showsreplay: enabled, which confirms that anti-replay is enabled for this IPsec tunnel. Anti-replay is a security feature that prevents replay attacks by ensuring that packets are not duplicated or reused.
* NPU Acceleration:
* TheNPU acceleration: encryption (outbound) decryption (inbound)line indicates that Network Processing Unit (NPU) acceleration is used.
* The npu_flag for this tunnel is 02. This indicates that encryption and decryption are handled by the NPU, improving the performance of the VPN tunnel.
References:
* Fortinet Community: Troubleshooting IPsec VPN Tunnels(Welcome to the Fortinet Community!)(Welcome to the Fortinet Community!).
* Fortinet Documentation: Verifying IPsec VPN Tunnels(Fortinet Docs)(Fortinet Docs).